Here is a type of password that is "reasonably" robust and yet "reasonably" easy to remember and type:
Select two random lowercase letters, then two random digits, then two random uppercase letters, then two random digits.
The lowercase/uppercase mix and the digits allow such passwords to be accepted by most "password rules". The entropy of such passwords is about 32 bits (because 262*102*262*102 = 4569760000, which is slightly above 232). That's not a lot, but sufficient to thwart online dictionary attacks (when the attackers tries to log on your server by "guessing" the password, possibly with a script). They offer non-negligible resistance to offline dictionary attacks (e.g. for a password-encrypted file, or the storage of hashed password in a database) IF (and only if) they are employed with proper password-strengthening techniques, i.e. salts and slow hashing (bcrypt).
It turns out that I find such passwords easy to remember. There are relatively convincing indirect clues that I am a human being and that my brain works, at least qualitatively, along the same lines than any other human being, including "managers". Thus, it is plausible that your manager would find such passwords easy to remember as well.
Important: when I say random, I mean it. Appropriate randomness cannot be achieved in the privacy of a human brain. You shall:
- use a computer to generate random digits and letters;
- within that computer, rely on a cryptographically secure PRNG (e.g.
/dev/urandom on Linux/FreeBSD/MacOS X or
CryptGenRandom() on Windows);
- accept the password. Don't generate a hundred passwords until you reach one which pleases you, because this reduces your entropy. Generate one password and learn it.
Ideally, we would not let users choose their own passwords; we would provide a tool which generates passwords for them. Depending on the situation, securely transmitting the computer-generated password to the human user could prove challenging, which is why we are not always in the ideal case.
It seems overly optimistic to expect average users to use and remember passwords with an entropy of more than 32 bits or so.
If your manager is not cooperative, there is an alternate plan: tell him to write down his password on a piece of paper, and keep that in his wallet. A wallet is relatively secure: at least, he takes care of it on a daily basis. This takes care of the "easy to remember" part, at least for the first days. Also, that's what the US president does for some of his nuclear launch codes (be sure to let your manager know that, too).
Do not enforce a rule of changing the password every month: such rules are irksome and they turn users into enemies (i.e. more or less voluntary accomplices for the attacker).
Make sure that users know that they should report loss of passwords promptly and that they will not be blamed. Realistically, once you have more than a dozen users, a password leak will occur (regardless of whether the password is stored in a wallet or in a brain). The only thing worse than a leaked password is a user concealing the leak out of fear of a sanction.